Anders Johansson wrote:
On Tuesday 12 October 2010 17:33:44 Per Jessen wrote:
I'm slowly beginning to move/migrate to rsyslogd - I can't quite find a useful equivalent to match() from syslog-ng. It looks like I need to use property based filters, as regexes are not available in the expression filters?
:msg, regex, "my.*regular..?expression"
No?
No, that is a property filter, not an expression ditto and it has a different syntax. I also can't see how property filters are combined? Anyway, how would you write the following syslog-ng filter for rsyslogd: filter per2 { facility(mail) and match("relay=virtual.*status=sent"); }; I've come up with this sofar, which will probably be fine, but it's not exactly the same: if ($syslogfacility-text=='mail') and \ ($msg contains 'relay=virtual') and ($msg contains 'status=sent') I can't help wondering why there is no support for: if ($msg regex '....') -- Per Jessen, Zürich (12.6°C) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org